search

QubesOS / qubes-issues

The Qubes OS Project issue tracker
https://www.qubes-os.org/doc/issue-tracking/
534 stars 46 forks source link

Fix IPv6 connectivity on downstream qubes #9288

Open ben-grande opened 3 months ago

ben-grande commented 3 months ago

How to file a helpful issue

Qubes OS release

R4.2

Brief summary

I have a router with IPv4 and IPv6 addresses. Network manager enables both to be used.

I followed the steps to enable IPv6, also restarted all netvms in the same chain. I configured on the Network Manager to use only the IPv6 connection and disable IPv4.

Only sys-net has network and every qube below it does not have network, no dns, no IPv4, no IPv6.

Steps to reproduce

Test on sys-net and sys-firewall:

$ curl 1.1.1.1

301 Moved Permanently

301 Moved Permanently

cloudflare

- Enable IPv6 for sys-net:
```sh
qvm-features sys-net ipv6 1

Retry the the connection:

Expected behavior

Network functional.

Actual behavior

No network, no DNS, no IPv4, no IPv6.

unman commented 3 months ago

Can you ping sys-net from sys-firewall?

ben-grande commented 3 months ago

Can you ping sys-net from sys-firewall?

I can ping sys-net from sys-firewall successfully before and after doing the changes.

unman commented 3 months ago

To be clear ping6 both ways?

unman commented 3 months ago

Can you ping6 router by IPv6 address from both ?

ben-grande commented 3 months ago

To be clear ping6 both ways?

From sys-firewall to sys-net using the value of eth0 inet6 address (got from sys-firewall), ping -6 works before and after disabling IPv4.

unman commented 3 months ago

ping6 2001:4860:4860::8888 from both?

unman commented 3 months ago

I ask because I have working 6 Did you remember to set nameserver?

unman commented 3 months ago

example.com provides ip4 and ip6 hosts for testing. Quad9 is 2620:fe::fe

traceroute6 may show you the issue

ben-grande commented 3 months ago

ping6 2001:4860:4860::8888 from both?

Works from both sys-net and sys-firewall before and after disabling IPv4.

I ask because I have working 6 Did you remember to set nameserver?

On sys-net, with IPv4 and IPv6 enabled, the Network Manager sets /etc/resolv.conf nameservers to the IPv4 address and IPv6 address of the router.

I did not set nameserver manully on sys-net or sys-firewall. After disabling IPv4, only the IPv6 nameserver remains on sys-net /etc/resolv.conf.

I am not sure to which extent does Qubes IPv6 DNS limitations to IPv6-only networks applies.

example.com provides ip4 and ip6 hosts for testing. Quad9 is 2620:fe::fe traceroute6 may show you the issue

From sys-firewall, pinging example.com with -4 and -6 works before disabling IPv4. After disabling, DNS is not resolved and I can ping only by IPv6 address, such as ping6 2001:4860:4860::8888.

I did not understand how to use traceroute in this case, therefore I used tcpdump.

Before disabling IPv4

After disabling IPv4

ben-grande commented 3 months ago

Ok, I used traceroute now.

Before disabling IPv4, traceoute6 example.com is fast on sys-net and sys-firewall.

After disabling IPv4, traceoute6 example.com is fast on sys-net and very slow (2+ minutes) on sys-firewall.

Following quotes are from IPv6 limitations in Qubes.

Currently only IPv4 DNS servers are configured, regardless of ipv6 feature state. It is done this way to avoid reconfiguring all connected qubes whenever IPv6 DNS becomes available or not.

That is good.

Configuring qubes to always use IPv6 DNS and only fallback to IPv4 may result in relatively long timeouts and poor usability.

Not good, does this issue fall into Qubes IPv6 DNS code stalled?

But note that DNS using IPv4 does not prevent to return IPv6 addresses. In practice this is only a problem for IPv6-only networks.